Using the gui and cli, how can one sign a message with the monero private key? And then how do you verify it with the gui / cli / online js application?


Sign & Verify using the cli

You can sign a file (which may hold your message) using the cli sign command like this

sign <file_to_sign>

The signature will be printed to the screen. You may then provide this signature to someone else to verify. The command to verify is

verify <filename> <address> <signature>

Try it yourself

You may reproduce those steps and make sure you get the same results:
Create a wallet using the seed austere locker smelting nozzle wagtail tuxedo acidic earth rover utility value tomorrow unusual vipers ferry dynamite algebra agenda rarest number rotate avatar deftly elapse avatar

(do not use this seed for anything else except this test)
Create a file named msg_file whose content is my message. sign the file:

[wallet 47e7vP]: sign msg_file
Wallet password: 

This is your signature. Then verify the signature:

[wallet 47e7vP]: address
[wallet 47e7vP]: verify msg_file 47e7vPdJA3WQbJRjT3WmGdSfocofRUiAYMTJSnjPAZwCfDcAmz2oBEZYV5KGJSYAA13Bj7D2bXiaWTfvKCfbDkDY2kuUFMf SigV1XED2SBdQuN37x5h73fzVorD6JSZaTBKfaA7mFx6pHnQp5Z9UnysaQKdYkJRKFhNMLVMrw2z7GJkzB1e5EnkD6ska
Good signature from 47e7vPdJA3WQbJRjT3WmGdSfocofRUiAYMTJSnjPAZwCfDcAmz2oBEZYV5KGJSYAA13Bj7D2bXiaWTfvKCfbDkDY2kuUFMf

If you sign the file yourself you will probably get a different signature than me. This is because the signing is not deterministic. Nevertheless, you should be able to verify my signature without problems.

Sign & Verify with another application using RPC

You can also use the official wallet rpc server (monero-wallet-rpc) to sign and verify from another application, using http request.
Start an rpc server by running monero-wallet-rpc with your desired flags. Assuming your rpc server runs on the local machine (localhost) and listens to port 18082, from the terminal run:

curl -X POST -d '{"method":"sign", "params":{"data":"my message"}}'

which will give you back:

  "id": 0,
  "jsonrpc": "2.0",
  "result": {
    "signature": "SigV1BwFKNzqm3YjbkkqVQ97TZCewPuqX5e6YZBuV6gkaXQXcAFfVEMBrMMVfYhax7hAcrJM7nHVW94APvPpV7NJRSEJB"

Then to verify, run:

curl -X POST -d '{"method":"verify","params":{"data":"my message", "address":"47e7vPdJA3WQbJRjT3WmGdSfocofRUiAYMTJSnjPAZwCfDcAmz2oBEZYV5KGJSYAA13Bj7D2bXiaWTfvKCfbDkDY2kuUFMf", "signature":"SigV1BwFKNzqm3YjbkkqVQ97TZCewPuqX5e6YZBuV6gkaXQXcAFfVEMBrMMVfYhax7hAcrJM7nHVW94APvPpV7NJRSEJB"}}'

to get the result

  "id": 0,
  "jsonrpc": "2.0",
  "result": {
    "good": true

Obviously, you can use this method with any application that supports http requests.

Note, signing a text file with the cli, and signing the text using rpc are two different methods, and you can't take signature from one method and verify it using another. This means you should use the same method both for signing and verifying.

  • what if my message isnt in a file. how do i just put my message in the cli? how do I expose these commands so I can run it as a web service from a php file? I want to build a small web app that taps into this. – Patoshi パトシ Sep 20 '17 at 21:41
  • The CLI wallet doesn't do messages because it's not always obvious what the message is, due to whitespace, etc. However, you can do that with a RPC call, which is suitable for web services. – user36303 Sep 20 '17 at 21:51

Using the example seed above, you can also do this in the GUI.

  1. Create a new wallet from the example seed above.
  2. Navigate to Receive tab.
  3. Copy the address.
  4. Navigate to Advanced > Sign/verify tab.
  5. Paste the address into "Signing address" field (at the bottom).
  6. Write "my message" in the the message field at the top.
  7. Click "Sign".
  8. Copy the generated "Signature" into the verification field (very last field)
  9. Copy the message into the verification "message" field.
  10. Click "Verify"

enter image description here

FYI: Here is the stealth address: 47e7vPdJA3WQbJRjT3WmGdSfocofRUiAYMTJSnjPAZwCfDcAmz2oBEZYV5KGJSYAA13Bj7D2bXiaWTfvKCfbDkDY2kuUFMf

Here is the sig I generated: SigV11PBWG78hUQPiYZ11bhCLDeeEjBSWXShGUSt2mPD6Zx9oMsXNKFY9uw3D5u6VquhX8uE8V62LVbY3vTsSMy9jDfF4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.